Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.PWS.Siggen.26846

Added to the Dr.Web virus database: 2011-09-08

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1631955863' = '<LS_APPDATA>\uhx.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks the following features:
  • Windows Security Center
Creates and executes the following:
  • <LS_APPDATA>\uhx.exe -gav <Full path to virus>
Searches for registry branches where third party applications store passwords:
  • [<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
  • [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
  • [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
  • [<HKLM>\Software\FlashFXP]
  • [<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
  • [<HKCU>\Software\BPFTP]
  • [<HKCU>\Software\South River Technologies\WebDrive\Connections]
  • [<HKLM>\Software\South River Technologies\WebDrive\Connections]
  • [<HKCU>\Software\FTPWare\COREFTP\Sites]
  • [<HKCU>\Software\Sota\FFFTP\Options]
  • [<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
  • [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
  • [<HKCU>\Software\Ghisler\Windows Commander]
  • [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
  • [<HKCU>\Software\Far\Plugins\FTP\Hosts]
  • [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
  • [<HKCU>\Software\Ghisler\Total Commander]
  • [<HKCU>\Software\FlashFXP]
  • [<HKLM>\Software\FlashFXP\3]
  • [<HKCU>\Software\FlashFXP\3]
  • [<HKLM>\Software\Ghisler\Windows Commander]
  • [<HKLM>\Software\Ghisler\Total Commander]
Modifies file system :
Creates the following files:
  • %TEMP%\aek1F7.tmp
  • %TEMP%\aek1F6.tmp
  • %TEMP%\aek1F8.tmp
  • %TEMP%\aek1FA.tmp
  • %TEMP%\aek1F9.tmp
  • %TEMP%\aek1F5.tmp
  • %TEMP%\aek1F1.tmp
  • %TEMP%\aek1F0.tmp
  • %TEMP%\aek1F2.tmp
  • %TEMP%\aek1F4.tmp
  • %TEMP%\aek1F3.tmp
  • %TEMP%\aek1FB.tmp
  • %TEMP%\aek203.tmp
  • %TEMP%\aek202.tmp
  • %TEMP%\aek204.tmp
  • %TEMP%\aek206.tmp
  • %TEMP%\aek205.tmp
  • %TEMP%\aek201.tmp
  • %TEMP%\aek1FD.tmp
  • %TEMP%\aek1FC.tmp
  • %TEMP%\aek1FE.tmp
  • %TEMP%\aek200.tmp
  • %TEMP%\aek1FF.tmp
  • %TEMP%\aek1EF.tmp
  • %TEMP%\aek1DF.tmp
  • %TEMP%\aek1DE.tmp
  • %TEMP%\aek1E0.tmp
  • %TEMP%\aek1E2.tmp
  • %TEMP%\aek1E1.tmp
  • %TEMP%\aek1DD.tmp
  • %TEMP%\aek1D9.tmp
  • %TEMP%\aek1D8.tmp
  • %TEMP%\aek1DA.tmp
  • %TEMP%\aek1DC.tmp
  • %TEMP%\aek1DB.tmp
  • %TEMP%\aek1E3.tmp
  • %TEMP%\aek1EB.tmp
  • %TEMP%\aek1EA.tmp
  • %TEMP%\aek1EC.tmp
  • %TEMP%\aek1EE.tmp
  • %TEMP%\aek1ED.tmp
  • %TEMP%\aek1E9.tmp
  • %TEMP%\aek1E5.tmp
  • %TEMP%\aek1E4.tmp
  • %TEMP%\aek1E6.tmp
  • %TEMP%\aek1E8.tmp
  • %TEMP%\aek1E7.tmp
  • %TEMP%\aek226.tmp
  • %TEMP%\aek225.tmp
  • %TEMP%\aek227.tmp
  • %TEMP%\aek229.tmp
  • %TEMP%\aek228.tmp
  • %TEMP%\aek224.tmp
  • %TEMP%\aek220.tmp
  • %TEMP%\aek21F.tmp
  • %TEMP%\aek221.tmp
  • %TEMP%\aek223.tmp
  • %TEMP%\aek222.tmp
  • %TEMP%\aek22A.tmp
  • %TEMP%\aek232.tmp
  • %TEMP%\aek231.tmp
  • %TEMP%\aek233.tmp
  • %TEMP%\aek235.tmp
  • %TEMP%\aek234.tmp
  • %TEMP%\aek230.tmp
  • %TEMP%\aek22C.tmp
  • %TEMP%\aek22B.tmp
  • %TEMP%\aek22D.tmp
  • %TEMP%\aek22F.tmp
  • %TEMP%\aek22E.tmp
  • %TEMP%\aek21E.tmp
  • %TEMP%\aek20E.tmp
  • %TEMP%\aek20D.tmp
  • %TEMP%\aek20F.tmp
  • %TEMP%\aek211.tmp
  • %TEMP%\aek210.tmp
  • %TEMP%\aek20C.tmp
  • %TEMP%\aek208.tmp
  • %TEMP%\aek207.tmp
  • %TEMP%\aek209.tmp
  • %TEMP%\aek20B.tmp
  • %TEMP%\aek20A.tmp
  • %TEMP%\aek212.tmp
  • %TEMP%\aek21A.tmp
  • %TEMP%\aek219.tmp
  • %TEMP%\aek21B.tmp
  • %TEMP%\aek21D.tmp
  • %TEMP%\aek21C.tmp
  • %TEMP%\aek218.tmp
  • %TEMP%\aek214.tmp
  • %TEMP%\aek213.tmp
  • %TEMP%\aek215.tmp
  • %TEMP%\aek217.tmp
  • %TEMP%\aek216.tmp
  • %TEMP%\aek199.tmp
  • %TEMP%\aek198.tmp
  • %TEMP%\aek19A.tmp
  • %TEMP%\aek19C.tmp
  • %TEMP%\aek19B.tmp
  • %TEMP%\aek197.tmp
  • %TEMP%\aek193.tmp
  • %TEMP%\aek192.tmp
  • %TEMP%\aek194.tmp
  • %TEMP%\aek196.tmp
  • %TEMP%\aek195.tmp
  • %TEMP%\aek19D.tmp
  • %TEMP%\aek1A5.tmp
  • %TEMP%\aek1A4.tmp
  • %TEMP%\aek1A6.tmp
  • %TEMP%\aek1A8.tmp
  • %TEMP%\aek1A7.tmp
  • %TEMP%\aek1A3.tmp
  • %TEMP%\aek19F.tmp
  • %TEMP%\aek19E.tmp
  • %TEMP%\aek1A0.tmp
  • %TEMP%\aek1A2.tmp
  • %TEMP%\aek1A1.tmp
  • %TEMP%\aek191.tmp
  • %TEMP%\aek181.tmp
  • %TEMP%\aek180.tmp
  • %TEMP%\aek182.tmp
  • %TEMP%\aek184.tmp
  • %TEMP%\aek183.tmp
  • %TEMP%\aek17F.tmp
  • %TEMP%\aek17B.tmp
  • %TEMP%\aek17A.tmp
  • %TEMP%\aek17C.tmp
  • %TEMP%\aek17E.tmp
  • %TEMP%\aek17D.tmp
  • %TEMP%\aek185.tmp
  • %TEMP%\aek18D.tmp
  • %TEMP%\aek18C.tmp
  • %TEMP%\aek18E.tmp
  • %TEMP%\aek190.tmp
  • %TEMP%\aek18F.tmp
  • %TEMP%\aek18B.tmp
  • %TEMP%\aek187.tmp
  • %TEMP%\aek186.tmp
  • %TEMP%\aek188.tmp
  • %TEMP%\aek18A.tmp
  • %TEMP%\aek189.tmp
  • %TEMP%\aek1C8.tmp
  • %TEMP%\aek1C7.tmp
  • %TEMP%\aek1C9.tmp
  • %TEMP%\aek1CB.tmp
  • %TEMP%\aek1CA.tmp
  • %TEMP%\aek1C6.tmp
  • %TEMP%\aek1C2.tmp
  • %TEMP%\aek1C1.tmp
  • %TEMP%\aek1C3.tmp
  • %TEMP%\aek1C5.tmp
  • %TEMP%\aek1C4.tmp
  • %TEMP%\aek1CC.tmp
  • %TEMP%\aek1D4.tmp
  • %TEMP%\aek1D3.tmp
  • %TEMP%\aek1D5.tmp
  • %TEMP%\aek1D7.tmp
  • %TEMP%\aek1D6.tmp
  • %TEMP%\aek1D2.tmp
  • %TEMP%\aek1CE.tmp
  • %TEMP%\aek1CD.tmp
  • %TEMP%\aek1CF.tmp
  • %TEMP%\aek1D1.tmp
  • %TEMP%\aek1D0.tmp
  • %TEMP%\aek1C0.tmp
  • %TEMP%\aek1B0.tmp
  • %TEMP%\aek1AF.tmp
  • %TEMP%\aek1B1.tmp
  • %TEMP%\aek1B3.tmp
  • %TEMP%\aek1B2.tmp
  • %TEMP%\aek1AE.tmp
  • %TEMP%\aek1AA.tmp
  • %TEMP%\aek1A9.tmp
  • %TEMP%\aek1AB.tmp
  • %TEMP%\aek1AD.tmp
  • %TEMP%\aek1AC.tmp
  • %TEMP%\aek1B4.tmp
  • %TEMP%\aek1BC.tmp
  • %TEMP%\aek1BB.tmp
  • %TEMP%\aek1BD.tmp
  • %TEMP%\aek1BF.tmp
  • %TEMP%\aek1BE.tmp
  • %TEMP%\aek1BA.tmp
  • %TEMP%\aek1B6.tmp
  • %TEMP%\aek1B5.tmp
  • %TEMP%\aek1B7.tmp
  • %TEMP%\aek1B9.tmp
  • %TEMP%\aek1B8.tmp
  • %TEMP%\aek236.tmp
  • %TEMP%\aek2A3.tmp
  • %TEMP%\aek2A2.tmp
  • %TEMP%\aek2A4.tmp
  • %TEMP%\aek2A6.tmp
  • %TEMP%\aek2A5.tmp
  • %TEMP%\aek2A1.tmp
  • %TEMP%\aek29D.tmp
  • %TEMP%\aek29C.tmp
  • %TEMP%\aek29E.tmp
  • %TEMP%\aek2A0.tmp
  • %TEMP%\aek29F.tmp
  • %TEMP%\aek2A7.tmp
  • %TEMP%\aek2AF.tmp
  • %TEMP%\aek2AE.tmp
  • %TEMP%\aek2B0.tmp
  • %TEMP%\aek2B2.tmp
  • %TEMP%\aek2B1.tmp
  • %TEMP%\aek2AD.tmp
  • %TEMP%\aek2A9.tmp
  • %TEMP%\aek2A8.tmp
  • %TEMP%\aek2AA.tmp
  • %TEMP%\aek2AC.tmp
  • %TEMP%\aek2AB.tmp
  • %TEMP%\aek29B.tmp
  • %TEMP%\aek28B.tmp
  • %TEMP%\aek28A.tmp
  • %TEMP%\aek28C.tmp
  • %TEMP%\aek28E.tmp
  • %TEMP%\aek28D.tmp
  • %TEMP%\aek289.tmp
  • %TEMP%\aek285.tmp
  • %TEMP%\aek284.tmp
  • %TEMP%\aek286.tmp
  • %TEMP%\aek288.tmp
  • %TEMP%\aek287.tmp
  • %TEMP%\aek28F.tmp
  • %TEMP%\aek297.tmp
  • %TEMP%\aek296.tmp
  • %TEMP%\aek298.tmp
  • %TEMP%\aek29A.tmp
  • %TEMP%\aek299.tmp
  • %TEMP%\aek295.tmp
  • %TEMP%\aek291.tmp
  • %TEMP%\aek290.tmp
  • %TEMP%\aek292.tmp
  • %TEMP%\aek294.tmp
  • %TEMP%\aek293.tmp
  • %TEMP%\aek2D2.tmp
  • %TEMP%\aek2D1.tmp
  • %TEMP%\aek2D3.tmp
  • %TEMP%\aek2D5.tmp
  • %TEMP%\aek2D4.tmp
  • %TEMP%\aek2D0.tmp
  • %TEMP%\aek2CC.tmp
  • %TEMP%\aek2CB.tmp
  • %TEMP%\aek2CD.tmp
  • %TEMP%\aek2CF.tmp
  • %TEMP%\aek2CE.tmp
  • %TEMP%\aek2D6.tmp
  • %TEMP%\aek2DE.tmp
  • %TEMP%\aek2DD.tmp
  • %TEMP%\aek2DF.tmp
  • %TEMP%\aek2E1.tmp
  • %TEMP%\aek2E0.tmp
  • %TEMP%\aek2DC.tmp
  • %TEMP%\aek2D8.tmp
  • %TEMP%\aek2D7.tmp
  • %TEMP%\aek2D9.tmp
  • %TEMP%\aek2DB.tmp
  • %TEMP%\aek2DA.tmp
  • %TEMP%\aek2CA.tmp
  • %TEMP%\aek2BA.tmp
  • %TEMP%\aek2B9.tmp
  • %TEMP%\aek2BB.tmp
  • %TEMP%\aek2BD.tmp
  • %TEMP%\aek2BC.tmp
  • %TEMP%\aek2B8.tmp
  • %TEMP%\aek2B4.tmp
  • %TEMP%\aek2B3.tmp
  • %TEMP%\aek2B5.tmp
  • %TEMP%\aek2B7.tmp
  • %TEMP%\aek2B6.tmp
  • %TEMP%\aek2BE.tmp
  • %TEMP%\aek2C6.tmp
  • %TEMP%\aek2C5.tmp
  • %TEMP%\aek2C7.tmp
  • %TEMP%\aek2C9.tmp
  • %TEMP%\aek2C8.tmp
  • %TEMP%\aek2C4.tmp
  • %TEMP%\aek2C0.tmp
  • %TEMP%\aek2BF.tmp
  • %TEMP%\aek2C1.tmp
  • %TEMP%\aek2C3.tmp
  • %TEMP%\aek2C2.tmp
  • %TEMP%\aek245.tmp
  • %TEMP%\aek244.tmp
  • %TEMP%\aek246.tmp
  • %TEMP%\aek248.tmp
  • %TEMP%\aek247.tmp
  • %TEMP%\aek243.tmp
  • %TEMP%\aek241.tmp
  • %ALLUSERSPROFILE%\Application Data\lypq.exe
  • %TEMP%\juvt.exe
  • %HOMEPATH%\Templates\qxkk.exe
  • %TEMP%\aek242.tmp
  • %TEMP%\aek249.tmp
  • %TEMP%\aek251.tmp
  • %TEMP%\aek250.tmp
  • %TEMP%\aek252.tmp
  • %TEMP%\aek254.tmp
  • %TEMP%\aek253.tmp
  • %TEMP%\aek24F.tmp
  • %TEMP%\aek24B.tmp
  • %TEMP%\aek24A.tmp
  • %TEMP%\aek24C.tmp
  • %TEMP%\aek24E.tmp
  • %TEMP%\aek24D.tmp
  • %TEMP%\aek240.tmp
  • %ALLUSERSPROFILE%\Application Data\yntf.exe
  • <LS_APPDATA>\feoo.exe
  • %TEMP%\fcqs.exe
  • <LS_APPDATA>\apcs.exe
  • %HOMEPATH%\Templates\glcd.exe
  • <LS_APPDATA>\uhx.exe
  • %TEMP%\aek238.tmp
  • %TEMP%\aek237.tmp
  • %TEMP%\aek239.tmp
  • %TEMP%\aek23B.tmp
  • %TEMP%\aek23A.tmp
  • %ALLUSERSPROFILE%\Application Data\qduq.exe
  • %TEMP%\tupo.exe
  • %TEMP%\aek23E.tmp
  • %TEMP%\aek23F.tmp
  • <LS_APPDATA>\rqav.exe
  • %HOMEPATH%\Templates\cqxp.exe
  • %TEMP%\aek23D.tmp
  • %TEMP%\tlkc.exe
  • %TEMP%\aek23C.tmp
  • %HOMEPATH%\Templates\rbye.exe
  • %ALLUSERSPROFILE%\Application Data\nnur.exe
  • <LS_APPDATA>\udum.exe
  • %TEMP%\aek274.tmp
  • %TEMP%\aek273.tmp
  • %TEMP%\aek275.tmp
  • %TEMP%\aek277.tmp
  • %TEMP%\aek276.tmp
  • %TEMP%\aek272.tmp
  • %TEMP%\aek26E.tmp
  • %TEMP%\aek26D.tmp
  • %TEMP%\aek26F.tmp
  • %TEMP%\aek271.tmp
  • %TEMP%\aek270.tmp
  • %TEMP%\aek278.tmp
  • %TEMP%\aek280.tmp
  • %TEMP%\aek27F.tmp
  • %TEMP%\aek281.tmp
  • %TEMP%\aek283.tmp
  • %TEMP%\aek282.tmp
  • %TEMP%\aek27E.tmp
  • %TEMP%\aek27A.tmp
  • %TEMP%\aek279.tmp
  • %TEMP%\aek27B.tmp
  • %TEMP%\aek27D.tmp
  • %TEMP%\aek27C.tmp
  • %TEMP%\aek26C.tmp
  • %TEMP%\aek25C.tmp
  • %TEMP%\aek25B.tmp
  • %TEMP%\aek25D.tmp
  • %TEMP%\aek25F.tmp
  • %TEMP%\aek25E.tmp
  • %TEMP%\aek25A.tmp
  • %TEMP%\aek256.tmp
  • %TEMP%\aek255.tmp
  • %TEMP%\aek257.tmp
  • %TEMP%\aek259.tmp
  • %TEMP%\aek258.tmp
  • %TEMP%\aek260.tmp
  • %TEMP%\aek268.tmp
  • %TEMP%\aek267.tmp
  • %TEMP%\aek269.tmp
  • %TEMP%\aek26B.tmp
  • %TEMP%\aek26A.tmp
  • %TEMP%\aek266.tmp
  • %TEMP%\aek262.tmp
  • %TEMP%\aek261.tmp
  • %TEMP%\aek263.tmp
  • %TEMP%\aek265.tmp
  • %TEMP%\aek264.tmp
  • %TEMP%\aek7E.tmp
  • %TEMP%\aek7D.tmp
  • %TEMP%\aek7F.tmp
  • %TEMP%\aek81.tmp
  • %TEMP%\aek80.tmp
  • %TEMP%\aek7C.tmp
  • %TEMP%\aek78.tmp
  • %TEMP%\aek77.tmp
  • %TEMP%\aek79.tmp
  • %TEMP%\aek7B.tmp
  • %TEMP%\aek7A.tmp
  • %TEMP%\aek82.tmp
  • %TEMP%\aek8A.tmp
  • %TEMP%\aek89.tmp
  • %TEMP%\aek8B.tmp
  • %TEMP%\aek8D.tmp
  • %TEMP%\aek8C.tmp
  • %TEMP%\aek88.tmp
  • %TEMP%\aek84.tmp
  • %TEMP%\aek83.tmp
  • %TEMP%\aek85.tmp
  • %TEMP%\aek87.tmp
  • %TEMP%\aek86.tmp
  • %TEMP%\aek76.tmp
  • %TEMP%\aek66.tmp
  • %TEMP%\aek65.tmp
  • %TEMP%\aek67.tmp
  • %TEMP%\aek69.tmp
  • %TEMP%\aek68.tmp
  • %TEMP%\aek64.tmp
  • %TEMP%\aek60.tmp
  • %TEMP%\aek5F.tmp
  • %TEMP%\aek61.tmp
  • %TEMP%\aek63.tmp
  • %TEMP%\aek62.tmp
  • %TEMP%\aek6A.tmp
  • %TEMP%\aek72.tmp
  • %TEMP%\aek71.tmp
  • %TEMP%\aek73.tmp
  • %TEMP%\aek75.tmp
  • %TEMP%\aek74.tmp
  • %TEMP%\aek70.tmp
  • %TEMP%\aek6C.tmp
  • %TEMP%\aek6B.tmp
  • %TEMP%\aek6D.tmp
  • %TEMP%\aek6F.tmp
  • %TEMP%\aek6E.tmp
  • %TEMP%\aekAD.tmp
  • %TEMP%\aekAC.tmp
  • %TEMP%\aekAE.tmp
  • %TEMP%\aekB0.tmp
  • %TEMP%\aekAF.tmp
  • %TEMP%\aekAB.tmp
  • %TEMP%\aekA7.tmp
  • %TEMP%\aekA6.tmp
  • %TEMP%\aekA8.tmp
  • %TEMP%\aekAA.tmp
  • %TEMP%\aekA9.tmp
  • %TEMP%\aekB1.tmp
  • %TEMP%\aekB9.tmp
  • %TEMP%\aekB8.tmp
  • %TEMP%\aekBA.tmp
  • %TEMP%\aekBC.tmp
  • %TEMP%\aekBB.tmp
  • %TEMP%\aekB7.tmp
  • %TEMP%\aekB3.tmp
  • %TEMP%\aekB2.tmp
  • %TEMP%\aekB4.tmp
  • %TEMP%\aekB6.tmp
  • %TEMP%\aekB5.tmp
  • %TEMP%\aekA5.tmp
  • %TEMP%\aek95.tmp
  • %TEMP%\aek94.tmp
  • %TEMP%\aek96.tmp
  • %TEMP%\aek98.tmp
  • %TEMP%\aek97.tmp
  • %TEMP%\aek93.tmp
  • %TEMP%\aek8F.tmp
  • %TEMP%\aek8E.tmp
  • %TEMP%\aek90.tmp
  • %TEMP%\aek92.tmp
  • %TEMP%\aek91.tmp
  • %TEMP%\aek99.tmp
  • %TEMP%\aekA1.tmp
  • %TEMP%\aekA0.tmp
  • %TEMP%\aekA2.tmp
  • %TEMP%\aekA4.tmp
  • %TEMP%\aekA3.tmp
  • %TEMP%\aek9F.tmp
  • %TEMP%\aek9B.tmp
  • %TEMP%\aek9A.tmp
  • %TEMP%\aek9C.tmp
  • %TEMP%\aek9E.tmp
  • %TEMP%\aek9D.tmp
  • %TEMP%\aek20.tmp
  • %TEMP%\aek1F.tmp
  • %TEMP%\aek21.tmp
  • %TEMP%\aek23.tmp
  • %TEMP%\aek22.tmp
  • %TEMP%\aek1E.tmp
  • %TEMP%\aek1A.tmp
  • %TEMP%\aek19.tmp
  • %TEMP%\aek1B.tmp
  • %TEMP%\aek1D.tmp
  • %TEMP%\aek1C.tmp
  • %TEMP%\aek24.tmp
  • %TEMP%\aek2C.tmp
  • %TEMP%\aek2B.tmp
  • %TEMP%\aek2D.tmp
  • %TEMP%\aek2F.tmp
  • %TEMP%\aek2E.tmp
  • %TEMP%\aek2A.tmp
  • %TEMP%\aek26.tmp
  • %TEMP%\aek25.tmp
  • %TEMP%\aek27.tmp
  • %TEMP%\aek29.tmp
  • %TEMP%\aek28.tmp
  • %TEMP%\aek18.tmp
  • %TEMP%\aek8.tmp
  • %TEMP%\aek7.tmp
  • %TEMP%\aek9.tmp
  • %TEMP%\aekB.tmp
  • %TEMP%\aekA.tmp
  • %TEMP%\aek6.tmp
  • %TEMP%\aek2.tmp
  • %TEMP%\aek1.tmp
  • %TEMP%\aek3.tmp
  • %TEMP%\aek5.tmp
  • %TEMP%\aek4.tmp
  • %TEMP%\aekC.tmp
  • %TEMP%\aek14.tmp
  • %TEMP%\aek13.tmp
  • %TEMP%\aek15.tmp
  • %TEMP%\aek17.tmp
  • %TEMP%\aek16.tmp
  • %TEMP%\aek12.tmp
  • %TEMP%\aekE.tmp
  • %TEMP%\aekD.tmp
  • %TEMP%\aekF.tmp
  • %TEMP%\aek11.tmp
  • %TEMP%\aek10.tmp
  • %TEMP%\aek4F.tmp
  • %TEMP%\aek4E.tmp
  • %TEMP%\aek50.tmp
  • %TEMP%\aek52.tmp
  • %TEMP%\aek51.tmp
  • %TEMP%\aek4D.tmp
  • %TEMP%\aek49.tmp
  • %TEMP%\aek48.tmp
  • %TEMP%\aek4A.tmp
  • %TEMP%\aek4C.tmp
  • %TEMP%\aek4B.tmp
  • %TEMP%\aek53.tmp
  • %TEMP%\aek5B.tmp
  • %TEMP%\aek5A.tmp
  • %TEMP%\aek5C.tmp
  • %TEMP%\aek5E.tmp
  • %TEMP%\aek5D.tmp
  • %TEMP%\aek59.tmp
  • %TEMP%\aek55.tmp
  • %TEMP%\aek54.tmp
  • %TEMP%\aek56.tmp
  • %TEMP%\aek58.tmp
  • %TEMP%\aek57.tmp
  • %TEMP%\aek47.tmp
  • %TEMP%\aek37.tmp
  • %TEMP%\aek36.tmp
  • %TEMP%\aek38.tmp
  • %TEMP%\aek3A.tmp
  • %TEMP%\aek39.tmp
  • %TEMP%\aek35.tmp
  • %TEMP%\aek31.tmp
  • %TEMP%\aek30.tmp
  • %TEMP%\aek32.tmp
  • %TEMP%\aek34.tmp
  • %TEMP%\aek33.tmp
  • %TEMP%\aek3B.tmp
  • %TEMP%\aek43.tmp
  • %TEMP%\aek42.tmp
  • %TEMP%\aek44.tmp
  • %TEMP%\aek46.tmp
  • %TEMP%\aek45.tmp
  • %TEMP%\aek41.tmp
  • %TEMP%\aek3D.tmp
  • %TEMP%\aek3C.tmp
  • %TEMP%\aek3E.tmp
  • %TEMP%\aek40.tmp
  • %TEMP%\aek3F.tmp
  • %TEMP%\aekBD.tmp
  • %TEMP%\aek13B.tmp
  • %TEMP%\aek13A.tmp
  • %TEMP%\aek13C.tmp
  • %TEMP%\aek13E.tmp
  • %TEMP%\aek13D.tmp
  • %TEMP%\aek139.tmp
  • %TEMP%\aek135.tmp
  • %TEMP%\aek134.tmp
  • %TEMP%\aek136.tmp
  • %TEMP%\aek138.tmp
  • %TEMP%\aek137.tmp
  • %TEMP%\aek13F.tmp
  • %TEMP%\aek147.tmp
  • %TEMP%\aek146.tmp
  • %TEMP%\aek148.tmp
  • %TEMP%\aek14A.tmp
  • %TEMP%\aek149.tmp
  • %TEMP%\aek145.tmp
  • %TEMP%\aek141.tmp
  • %TEMP%\aek140.tmp
  • %TEMP%\aek142.tmp
  • %TEMP%\aek144.tmp
  • %TEMP%\aek143.tmp
  • %TEMP%\aek133.tmp
  • %TEMP%\aek123.tmp
  • %TEMP%\aek122.tmp
  • %TEMP%\aek124.tmp
  • %TEMP%\aek126.tmp
  • %TEMP%\aek125.tmp
  • %TEMP%\aek121.tmp
  • %TEMP%\aek11D.tmp
  • %TEMP%\aek11C.tmp
  • %TEMP%\aek11E.tmp
  • %TEMP%\aek120.tmp
  • %TEMP%\aek11F.tmp
  • %TEMP%\aek127.tmp
  • %TEMP%\aek12F.tmp
  • %TEMP%\aek12E.tmp
  • %TEMP%\aek130.tmp
  • %TEMP%\aek132.tmp
  • %TEMP%\aek131.tmp
  • %TEMP%\aek12D.tmp
  • %TEMP%\aek129.tmp
  • %TEMP%\aek128.tmp
  • %TEMP%\aek12A.tmp
  • %TEMP%\aek12C.tmp
  • %TEMP%\aek12B.tmp
  • %TEMP%\aek16A.tmp
  • %TEMP%\aek169.tmp
  • %TEMP%\aek16B.tmp
  • %TEMP%\aek16D.tmp
  • %TEMP%\aek16C.tmp
  • %TEMP%\aek168.tmp
  • %TEMP%\aek164.tmp
  • %TEMP%\aek163.tmp
  • %TEMP%\aek165.tmp
  • %TEMP%\aek167.tmp
  • %TEMP%\aek166.tmp
  • %TEMP%\aek16E.tmp
  • %TEMP%\aek176.tmp
  • %TEMP%\aek175.tmp
  • %TEMP%\aek177.tmp
  • %TEMP%\aek179.tmp
  • %TEMP%\aek178.tmp
  • %TEMP%\aek174.tmp
  • %TEMP%\aek170.tmp
  • %TEMP%\aek16F.tmp
  • %TEMP%\aek171.tmp
  • %TEMP%\aek173.tmp
  • %TEMP%\aek172.tmp
  • %TEMP%\aek162.tmp
  • %TEMP%\aek152.tmp
  • %TEMP%\aek151.tmp
  • %TEMP%\aek153.tmp
  • %TEMP%\aek155.tmp
  • %TEMP%\aek154.tmp
  • %TEMP%\aek150.tmp
  • %TEMP%\aek14C.tmp
  • %TEMP%\aek14B.tmp
  • %TEMP%\aek14D.tmp
  • %TEMP%\aek14F.tmp
  • %TEMP%\aek14E.tmp
  • %TEMP%\aek156.tmp
  • %TEMP%\aek15E.tmp
  • %TEMP%\aek15D.tmp
  • %TEMP%\aek15F.tmp
  • %TEMP%\aek161.tmp
  • %TEMP%\aek160.tmp
  • %TEMP%\aek15C.tmp
  • %TEMP%\aek158.tmp
  • %TEMP%\aek157.tmp
  • %TEMP%\aek159.tmp
  • %TEMP%\aek15B.tmp
  • %TEMP%\aek15A.tmp
  • %TEMP%\aekDD.tmp
  • %TEMP%\aekDC.tmp
  • %TEMP%\aekDE.tmp
  • %TEMP%\aekE0.tmp
  • %TEMP%\aekDF.tmp
  • %TEMP%\aekDB.tmp
  • %TEMP%\aekD7.tmp
  • %TEMP%\aekD6.tmp
  • %TEMP%\aekD8.tmp
  • %TEMP%\aekDA.tmp
  • %TEMP%\aekD9.tmp
  • %TEMP%\aekE1.tmp
  • %TEMP%\aekE9.tmp
  • %TEMP%\aekE8.tmp
  • %TEMP%\aekEA.tmp
  • %TEMP%\aekEC.tmp
  • %TEMP%\aekEB.tmp
  • %TEMP%\aekE7.tmp
  • %TEMP%\aekE3.tmp
  • %TEMP%\aekE2.tmp
  • %TEMP%\aekE4.tmp
  • %TEMP%\aekE6.tmp
  • %TEMP%\aekE5.tmp
  • %TEMP%\aekD5.tmp
  • %TEMP%\aekC5.tmp
  • %TEMP%\aekC4.tmp
  • %TEMP%\aekC6.tmp
  • %TEMP%\aekC8.tmp
  • %TEMP%\aekC7.tmp
  • %TEMP%\aekC3.tmp
  • %TEMP%\aekBF.tmp
  • %TEMP%\aekBE.tmp
  • %TEMP%\aekC0.tmp
  • %TEMP%\aekC2.tmp
  • %TEMP%\aekC1.tmp
  • %TEMP%\aekC9.tmp
  • %TEMP%\aekD1.tmp
  • %TEMP%\aekD0.tmp
  • %TEMP%\aekD2.tmp
  • %TEMP%\aekD4.tmp
  • %TEMP%\aekD3.tmp
  • %TEMP%\aekCF.tmp
  • %TEMP%\aekCB.tmp
  • %TEMP%\aekCA.tmp
  • %TEMP%\aekCC.tmp
  • %TEMP%\aekCE.tmp
  • %TEMP%\aekCD.tmp
  • %TEMP%\aek10C.tmp
  • %TEMP%\aek10B.tmp
  • %TEMP%\aek10D.tmp
  • %TEMP%\aek10F.tmp
  • %TEMP%\aek10E.tmp
  • %TEMP%\aek10A.tmp
  • %TEMP%\aek106.tmp
  • %TEMP%\aek105.tmp
  • %TEMP%\aek107.tmp
  • %TEMP%\aek109.tmp
  • %TEMP%\aek108.tmp
  • %TEMP%\aek110.tmp
  • %TEMP%\aek118.tmp
  • %TEMP%\aek117.tmp
  • %TEMP%\aek119.tmp
  • %TEMP%\aek11B.tmp
  • %TEMP%\aek11A.tmp
  • %TEMP%\aek116.tmp
  • %TEMP%\aek112.tmp
  • %TEMP%\aek111.tmp
  • %TEMP%\aek113.tmp
  • %TEMP%\aek115.tmp
  • %TEMP%\aek114.tmp
  • %TEMP%\aek104.tmp
  • %TEMP%\aekF4.tmp
  • %TEMP%\aekF3.tmp
  • %TEMP%\aekF5.tmp
  • %TEMP%\aekF7.tmp
  • %TEMP%\aekF6.tmp
  • %TEMP%\aekF2.tmp
  • %TEMP%\aekEE.tmp
  • %TEMP%\aekED.tmp
  • %TEMP%\aekEF.tmp
  • %TEMP%\aekF1.tmp
  • %TEMP%\aekF0.tmp
  • %TEMP%\aekF8.tmp
  • %TEMP%\aek100.tmp
  • %TEMP%\aekFF.tmp
  • %TEMP%\aek101.tmp
  • %TEMP%\aek103.tmp
  • %TEMP%\aek102.tmp
  • %TEMP%\aekFE.tmp
  • %TEMP%\aekFA.tmp
  • %TEMP%\aekF9.tmp
  • %TEMP%\aekFB.tmp
  • %TEMP%\aekFD.tmp
  • %TEMP%\aekFC.tmp
Deletes the following files:
  • %TEMP%\aek1EB.tmp
  • %TEMP%\aek1EA.tmp
  • %TEMP%\aek1EC.tmp
  • %TEMP%\aek1EE.tmp
  • %TEMP%\aek1ED.tmp
  • %TEMP%\aek1E9.tmp
  • %TEMP%\aek1E5.tmp
  • %TEMP%\aek1E4.tmp
  • %TEMP%\aek1E6.tmp
  • %TEMP%\aek1E8.tmp
  • %TEMP%\aek1E7.tmp
  • %TEMP%\aek1EF.tmp
  • %TEMP%\aek1F7.tmp
  • %TEMP%\aek1F6.tmp
  • %TEMP%\aek1F8.tmp
  • %TEMP%\aek1FA.tmp
  • %TEMP%\aek1F9.tmp
  • %TEMP%\aek1F5.tmp
  • %TEMP%\aek1F1.tmp
  • %TEMP%\aek1F0.tmp
  • %TEMP%\aek1F2.tmp
  • %TEMP%\aek1F4.tmp
  • %TEMP%\aek1F3.tmp
  • %TEMP%\aek1D4.tmp
  • %TEMP%\aek1D3.tmp
  • %TEMP%\aek1D5.tmp
  • %TEMP%\aek1D7.tmp
  • %TEMP%\aek1D6.tmp
  • %TEMP%\aek1D2.tmp
  • %TEMP%\aek1CE.tmp
  • %TEMP%\aek1CD.tmp
  • %TEMP%\aek1CF.tmp
  • %TEMP%\aek1D1.tmp
  • %TEMP%\aek1D0.tmp
  • %TEMP%\aek1D8.tmp
  • %TEMP%\aek1E0.tmp
  • %TEMP%\aek1DF.tmp
  • %TEMP%\aek1E1.tmp
  • %TEMP%\aek1E3.tmp
  • %TEMP%\aek1E2.tmp
  • %TEMP%\aek1DE.tmp
  • %TEMP%\aek1DA.tmp
  • %TEMP%\aek1D9.tmp
  • %TEMP%\aek1DB.tmp
  • %TEMP%\aek1DD.tmp
  • %TEMP%\aek1DC.tmp
  • %TEMP%\aek219.tmp
  • %TEMP%\aek218.tmp
  • %TEMP%\aek21A.tmp
  • %TEMP%\aek21C.tmp
  • %TEMP%\aek21B.tmp
  • %TEMP%\aek217.tmp
  • %TEMP%\aek213.tmp
  • %TEMP%\aek212.tmp
  • %TEMP%\aek214.tmp
  • %TEMP%\aek216.tmp
  • %TEMP%\aek215.tmp
  • %TEMP%\aek21D.tmp
  • %TEMP%\aek225.tmp
  • %TEMP%\aek224.tmp
  • %TEMP%\aek226.tmp
  • %TEMP%\aek228.tmp
  • %TEMP%\aek227.tmp
  • %TEMP%\aek223.tmp
  • %TEMP%\aek21F.tmp
  • %TEMP%\aek21E.tmp
  • %TEMP%\aek220.tmp
  • %TEMP%\aek222.tmp
  • %TEMP%\aek221.tmp
  • %TEMP%\aek202.tmp
  • %TEMP%\aek201.tmp
  • %TEMP%\aek203.tmp
  • %TEMP%\aek205.tmp
  • %TEMP%\aek204.tmp
  • %TEMP%\aek200.tmp
  • %TEMP%\aek1FC.tmp
  • %TEMP%\aek1FB.tmp
  • %TEMP%\aek1FD.tmp
  • %TEMP%\aek1FF.tmp
  • %TEMP%\aek1FE.tmp
  • %TEMP%\aek206.tmp
  • %TEMP%\aek20E.tmp
  • %TEMP%\aek20D.tmp
  • %TEMP%\aek20F.tmp
  • %TEMP%\aek211.tmp
  • %TEMP%\aek210.tmp
  • %TEMP%\aek20C.tmp
  • %TEMP%\aek208.tmp
  • %TEMP%\aek207.tmp
  • %TEMP%\aek209.tmp
  • %TEMP%\aek20B.tmp
  • %TEMP%\aek20A.tmp
  • %TEMP%\aek18F.tmp
  • %TEMP%\aek18E.tmp
  • %TEMP%\aek190.tmp
  • %TEMP%\aek192.tmp
  • %TEMP%\aek191.tmp
  • %TEMP%\aek18D.tmp
  • %TEMP%\aek189.tmp
  • %TEMP%\aek188.tmp
  • %TEMP%\aek18A.tmp
  • %TEMP%\aek18C.tmp
  • %TEMP%\aek18B.tmp
  • %TEMP%\aek193.tmp
  • %TEMP%\aek19B.tmp
  • %TEMP%\aek19A.tmp
  • %TEMP%\aek19C.tmp
  • %TEMP%\aek19E.tmp
  • %TEMP%\aek19D.tmp
  • %TEMP%\aek199.tmp
  • %TEMP%\aek195.tmp
  • %TEMP%\aek194.tmp
  • %TEMP%\aek196.tmp
  • %TEMP%\aek198.tmp
  • %TEMP%\aek197.tmp
  • %TEMP%\aek178.tmp
  • %TEMP%\aek177.tmp
  • %TEMP%\aek179.tmp
  • %TEMP%\aek17B.tmp
  • %TEMP%\aek17A.tmp
  • %TEMP%\aek176.tmp
  • %TEMP%\aek172.tmp
  • %TEMP%\aek171.tmp
  • %TEMP%\aek173.tmp
  • %TEMP%\aek175.tmp
  • %TEMP%\aek174.tmp
  • %TEMP%\aek17C.tmp
  • %TEMP%\aek184.tmp
  • %TEMP%\aek183.tmp
  • %TEMP%\aek185.tmp
  • %TEMP%\aek187.tmp
  • %TEMP%\aek186.tmp
  • %TEMP%\aek182.tmp
  • %TEMP%\aek17E.tmp
  • %TEMP%\aek17D.tmp
  • %TEMP%\aek17F.tmp
  • %TEMP%\aek181.tmp
  • %TEMP%\aek180.tmp
  • %TEMP%\aek1BD.tmp
  • %TEMP%\aek1BC.tmp
  • %TEMP%\aek1BE.tmp
  • %TEMP%\aek1C0.tmp
  • %TEMP%\aek1BF.tmp
  • %TEMP%\aek1BB.tmp
  • %TEMP%\aek1B7.tmp
  • %TEMP%\aek1B6.tmp
  • %TEMP%\aek1B8.tmp
  • %TEMP%\aek1BA.tmp
  • %TEMP%\aek1B9.tmp
  • %TEMP%\aek1C1.tmp
  • %TEMP%\aek1C9.tmp
  • %TEMP%\aek1C8.tmp
  • %TEMP%\aek1CA.tmp
  • %TEMP%\aek1CC.tmp
  • %TEMP%\aek1CB.tmp
  • %TEMP%\aek1C7.tmp
  • %TEMP%\aek1C3.tmp
  • %TEMP%\aek1C2.tmp
  • %TEMP%\aek1C4.tmp
  • %TEMP%\aek1C6.tmp
  • %TEMP%\aek1C5.tmp
  • %TEMP%\aek1A6.tmp
  • %TEMP%\aek1A5.tmp
  • %TEMP%\aek1A7.tmp
  • %TEMP%\aek1A9.tmp
  • %TEMP%\aek1A8.tmp
  • %TEMP%\aek1A4.tmp
  • %TEMP%\aek1A0.tmp
  • %TEMP%\aek19F.tmp
  • %TEMP%\aek1A1.tmp
  • %TEMP%\aek1A3.tmp
  • %TEMP%\aek1A2.tmp
  • %TEMP%\aek1AA.tmp
  • %TEMP%\aek1B2.tmp
  • %TEMP%\aek1B1.tmp
  • %TEMP%\aek1B3.tmp
  • %TEMP%\aek1B5.tmp
  • %TEMP%\aek1B4.tmp
  • %TEMP%\aek1B0.tmp
  • %TEMP%\aek1AC.tmp
  • %TEMP%\aek1AB.tmp
  • %TEMP%\aek1AD.tmp
  • %TEMP%\aek1AF.tmp
  • %TEMP%\aek1AE.tmp
  • %TEMP%\aek2A3.tmp
  • %TEMP%\aek2A2.tmp
  • %TEMP%\aek2A4.tmp
  • %TEMP%\aek2A6.tmp
  • %TEMP%\aek2A5.tmp
  • %TEMP%\aek2A1.tmp
  • %TEMP%\aek29D.tmp
  • %TEMP%\aek29C.tmp
  • %TEMP%\aek29E.tmp
  • %TEMP%\aek2A0.tmp
  • %TEMP%\aek29F.tmp
  • %TEMP%\aek2A7.tmp
  • %TEMP%\aek2AF.tmp
  • %TEMP%\aek2AE.tmp
  • %TEMP%\aek2B0.tmp
  • %TEMP%\aek2B2.tmp
  • %TEMP%\aek2B1.tmp
  • %TEMP%\aek2AD.tmp
  • %TEMP%\aek2A9.tmp
  • %TEMP%\aek2A8.tmp
  • %TEMP%\aek2AA.tmp
  • %TEMP%\aek2AC.tmp
  • %TEMP%\aek2AB.tmp
  • %TEMP%\aek28C.tmp
  • %TEMP%\aek28B.tmp
  • %TEMP%\aek28D.tmp
  • %TEMP%\aek28F.tmp
  • %TEMP%\aek28E.tmp
  • %TEMP%\aek28A.tmp
  • %TEMP%\aek286.tmp
  • %TEMP%\aek285.tmp
  • %TEMP%\aek287.tmp
  • %TEMP%\aek289.tmp
  • %TEMP%\aek288.tmp
  • %TEMP%\aek290.tmp
  • %TEMP%\aek298.tmp
  • %TEMP%\aek297.tmp
  • %TEMP%\aek299.tmp
  • %TEMP%\aek29B.tmp
  • %TEMP%\aek29A.tmp
  • %TEMP%\aek296.tmp
  • %TEMP%\aek292.tmp
  • %TEMP%\aek291.tmp
  • %TEMP%\aek293.tmp
  • %TEMP%\aek295.tmp
  • %TEMP%\aek294.tmp
  • %TEMP%\aek2D1.tmp
  • %TEMP%\aek2D0.tmp
  • %TEMP%\aek2D2.tmp
  • %TEMP%\aek2D4.tmp
  • %TEMP%\aek2D3.tmp
  • %TEMP%\aek2CF.tmp
  • %TEMP%\aek2CB.tmp
  • %TEMP%\aek2CA.tmp
  • %TEMP%\aek2CC.tmp
  • %TEMP%\aek2CE.tmp
  • %TEMP%\aek2CD.tmp
  • %TEMP%\aek2D5.tmp
  • %TEMP%\aek2DD.tmp
  • %TEMP%\aek2DC.tmp
  • %TEMP%\aek2DE.tmp
  • %TEMP%\aek2E0.tmp
  • %TEMP%\aek2DF.tmp
  • %TEMP%\aek2DB.tmp
  • %TEMP%\aek2D7.tmp
  • %TEMP%\aek2D6.tmp
  • %TEMP%\aek2D8.tmp
  • %TEMP%\aek2DA.tmp
  • %TEMP%\aek2D9.tmp
  • %TEMP%\aek2BA.tmp
  • %TEMP%\aek2B9.tmp
  • %TEMP%\aek2BB.tmp
  • %TEMP%\aek2BD.tmp
  • %TEMP%\aek2BC.tmp
  • %TEMP%\aek2B8.tmp
  • %TEMP%\aek2B4.tmp
  • %TEMP%\aek2B3.tmp
  • %TEMP%\aek2B5.tmp
  • %TEMP%\aek2B7.tmp
  • %TEMP%\aek2B6.tmp
  • %TEMP%\aek2BE.tmp
  • %TEMP%\aek2C6.tmp
  • %TEMP%\aek2C5.tmp
  • %TEMP%\aek2C7.tmp
  • %TEMP%\aek2C9.tmp
  • %TEMP%\aek2C8.tmp
  • %TEMP%\aek2C4.tmp
  • %TEMP%\aek2C0.tmp
  • %TEMP%\aek2BF.tmp
  • %TEMP%\aek2C1.tmp
  • %TEMP%\aek2C3.tmp
  • %TEMP%\aek2C2.tmp
  • %TEMP%\aek247.tmp
  • %TEMP%\aek246.tmp
  • %TEMP%\aek248.tmp
  • %TEMP%\aek24A.tmp
  • %TEMP%\aek249.tmp
  • %TEMP%\aek245.tmp
  • %TEMP%\aek241.tmp
  • %TEMP%\aek240.tmp
  • %TEMP%\aek242.tmp
  • %TEMP%\aek244.tmp
  • %TEMP%\aek243.tmp
  • %TEMP%\aek24B.tmp
  • %TEMP%\aek253.tmp
  • %TEMP%\aek252.tmp
  • %TEMP%\aek254.tmp
  • %TEMP%\aek256.tmp
  • %TEMP%\aek255.tmp
  • %TEMP%\aek251.tmp
  • %TEMP%\aek24D.tmp
  • %TEMP%\aek24C.tmp
  • %TEMP%\aek24E.tmp
  • %TEMP%\aek250.tmp
  • %TEMP%\aek24F.tmp
  • %TEMP%\aek230.tmp
  • %TEMP%\aek22F.tmp
  • %TEMP%\aek231.tmp
  • %TEMP%\aek233.tmp
  • %TEMP%\aek232.tmp
  • %TEMP%\aek22E.tmp
  • %TEMP%\aek22A.tmp
  • %TEMP%\aek229.tmp
  • %TEMP%\aek22B.tmp
  • %TEMP%\aek22D.tmp
  • %TEMP%\aek22C.tmp
  • %TEMP%\aek234.tmp
  • %TEMP%\aek23C.tmp
  • %TEMP%\aek23B.tmp
  • %TEMP%\aek23D.tmp
  • %TEMP%\aek23F.tmp
  • %TEMP%\aek23E.tmp
  • %TEMP%\aek23A.tmp
  • %TEMP%\aek236.tmp
  • %TEMP%\aek235.tmp
  • %TEMP%\aek237.tmp
  • %TEMP%\aek239.tmp
  • %TEMP%\aek238.tmp
  • %TEMP%\aek275.tmp
  • %TEMP%\aek274.tmp
  • %TEMP%\aek276.tmp
  • %TEMP%\aek278.tmp
  • %TEMP%\aek277.tmp
  • %TEMP%\aek273.tmp
  • %TEMP%\aek26F.tmp
  • %TEMP%\aek26E.tmp
  • %TEMP%\aek270.tmp
  • %TEMP%\aek272.tmp
  • %TEMP%\aek271.tmp
  • %TEMP%\aek279.tmp
  • %TEMP%\aek281.tmp
  • %TEMP%\aek280.tmp
  • %TEMP%\aek282.tmp
  • %TEMP%\aek284.tmp
  • %TEMP%\aek283.tmp
  • %TEMP%\aek27F.tmp
  • %TEMP%\aek27B.tmp
  • %TEMP%\aek27A.tmp
  • %TEMP%\aek27C.tmp
  • %TEMP%\aek27E.tmp
  • %TEMP%\aek27D.tmp
  • %TEMP%\aek25E.tmp
  • %TEMP%\aek25D.tmp
  • %TEMP%\aek25F.tmp
  • %TEMP%\aek261.tmp
  • %TEMP%\aek260.tmp
  • %TEMP%\aek25C.tmp
  • %TEMP%\aek258.tmp
  • %TEMP%\aek257.tmp
  • %TEMP%\aek259.tmp
  • %TEMP%\aek25B.tmp
  • %TEMP%\aek25A.tmp
  • %TEMP%\aek262.tmp
  • %TEMP%\aek26A.tmp
  • %TEMP%\aek269.tmp
  • %TEMP%\aek26B.tmp
  • %TEMP%\aek26D.tmp
  • %TEMP%\aek26C.tmp
  • %TEMP%\aek268.tmp
  • %TEMP%\aek264.tmp
  • %TEMP%\aek263.tmp
  • %TEMP%\aek265.tmp
  • %TEMP%\aek267.tmp
  • %TEMP%\aek266.tmp
  • %TEMP%\aek7B.tmp
  • %TEMP%\aek7A.tmp
  • %TEMP%\aek7C.tmp
  • %TEMP%\aek7E.tmp
  • %TEMP%\aek7D.tmp
  • %TEMP%\aek79.tmp
  • %TEMP%\aek75.tmp
  • %TEMP%\aek74.tmp
  • %TEMP%\aek76.tmp
  • %TEMP%\aek78.tmp
  • %TEMP%\aek77.tmp
  • %TEMP%\aek7F.tmp
  • %TEMP%\aek87.tmp
  • %TEMP%\aek86.tmp
  • %TEMP%\aek88.tmp
  • %TEMP%\aek8A.tmp
  • %TEMP%\aek89.tmp
  • %TEMP%\aek85.tmp
  • %TEMP%\aek81.tmp
  • %TEMP%\aek80.tmp
  • %TEMP%\aek82.tmp
  • %TEMP%\aek84.tmp
  • %TEMP%\aek83.tmp
  • %TEMP%\aek64.tmp
  • %TEMP%\aek63.tmp
  • %TEMP%\aek65.tmp
  • %TEMP%\aek67.tmp
  • %TEMP%\aek66.tmp
  • %TEMP%\aek62.tmp
  • %TEMP%\aek5E.tmp
  • %TEMP%\aek5D.tmp
  • %TEMP%\aek5F.tmp
  • %TEMP%\aek61.tmp
  • %TEMP%\aek60.tmp
  • %TEMP%\aek68.tmp
  • %TEMP%\aek70.tmp
  • %TEMP%\aek6F.tmp
  • %TEMP%\aek71.tmp
  • %TEMP%\aek73.tmp
  • %TEMP%\aek72.tmp
  • %TEMP%\aek6E.tmp
  • %TEMP%\aek6A.tmp
  • %TEMP%\aek69.tmp
  • %TEMP%\aek6B.tmp
  • %TEMP%\aek6D.tmp
  • %TEMP%\aek6C.tmp
  • %TEMP%\aekA9.tmp
  • %TEMP%\aekA8.tmp
  • %TEMP%\aekAA.tmp
  • %TEMP%\aekAC.tmp
  • %TEMP%\aekAB.tmp
  • %TEMP%\aekA7.tmp
  • %TEMP%\aekA3.tmp
  • %TEMP%\aekA2.tmp
  • %TEMP%\aekA4.tmp
  • %TEMP%\aekA6.tmp
  • %TEMP%\aekA5.tmp
  • %TEMP%\aekAD.tmp
  • %TEMP%\aekB5.tmp
  • %TEMP%\aekB4.tmp
  • %TEMP%\aekB6.tmp
  • %TEMP%\aekB8.tmp
  • %TEMP%\aekB7.tmp
  • %TEMP%\aekB3.tmp
  • %TEMP%\aekAF.tmp
  • %TEMP%\aekAE.tmp
  • %TEMP%\aekB0.tmp
  • %TEMP%\aekB2.tmp
  • %TEMP%\aekB1.tmp
  • %TEMP%\aek92.tmp
  • %TEMP%\aek91.tmp
  • %TEMP%\aek93.tmp
  • %TEMP%\aek95.tmp
  • %TEMP%\aek94.tmp
  • %TEMP%\aek90.tmp
  • %TEMP%\aek8C.tmp
  • %TEMP%\aek8B.tmp
  • %TEMP%\aek8D.tmp
  • %TEMP%\aek8F.tmp
  • %TEMP%\aek8E.tmp
  • %TEMP%\aek96.tmp
  • %TEMP%\aek9E.tmp
  • %TEMP%\aek9D.tmp
  • %TEMP%\aek9F.tmp
  • %TEMP%\aekA1.tmp
  • %TEMP%\aekA0.tmp
  • %TEMP%\aek9C.tmp
  • %TEMP%\aek98.tmp
  • %TEMP%\aek97.tmp
  • %TEMP%\aek99.tmp
  • %TEMP%\aek9B.tmp
  • %TEMP%\aek9A.tmp
  • %TEMP%\aek1F.tmp
  • %TEMP%\aek1E.tmp
  • %TEMP%\aek20.tmp
  • %TEMP%\aek22.tmp
  • %TEMP%\aek21.tmp
  • %TEMP%\aek1D.tmp
  • %TEMP%\aek19.tmp
  • %TEMP%\aek18.tmp
  • %TEMP%\aek1A.tmp
  • %TEMP%\aek1C.tmp
  • %TEMP%\aek1B.tmp
  • %TEMP%\aek23.tmp
  • %TEMP%\aek2B.tmp
  • %TEMP%\aek2A.tmp
  • %TEMP%\aek2C.tmp
  • %TEMP%\aek2E.tmp
  • %TEMP%\aek2D.tmp
  • %TEMP%\aek29.tmp
  • %TEMP%\aek25.tmp
  • %TEMP%\aek24.tmp
  • %TEMP%\aek26.tmp
  • %TEMP%\aek28.tmp
  • %TEMP%\aek27.tmp
  • %TEMP%\aek8.tmp
  • %TEMP%\aek7.tmp
  • %TEMP%\aek9.tmp
  • %TEMP%\aekB.tmp
  • %TEMP%\aekA.tmp
  • %TEMP%\aek6.tmp
  • %TEMP%\aek2.tmp
  • %TEMP%\aek1.tmp
  • %TEMP%\aek3.tmp
  • %TEMP%\aek5.tmp
  • %TEMP%\aek4.tmp
  • %TEMP%\aekC.tmp
  • %TEMP%\aek14.tmp
  • %TEMP%\aek13.tmp
  • %TEMP%\aek15.tmp
  • %TEMP%\aek17.tmp
  • %TEMP%\aek16.tmp
  • %TEMP%\aek12.tmp
  • %TEMP%\aekE.tmp
  • %TEMP%\aekD.tmp
  • %TEMP%\aekF.tmp
  • %TEMP%\aek11.tmp
  • %TEMP%\aek10.tmp
  • %TEMP%\aek4D.tmp
  • %TEMP%\aek4C.tmp
  • %TEMP%\aek4E.tmp
  • %TEMP%\aek50.tmp
  • %TEMP%\aek4F.tmp
  • %TEMP%\aek4B.tmp
  • %TEMP%\aek47.tmp
  • %TEMP%\aek46.tmp
  • %TEMP%\aek48.tmp
  • %TEMP%\aek4A.tmp
  • %TEMP%\aek49.tmp
  • %TEMP%\aek51.tmp
  • %TEMP%\aek59.tmp
  • %TEMP%\aek58.tmp
  • %TEMP%\aek5A.tmp
  • %TEMP%\aek5C.tmp
  • %TEMP%\aek5B.tmp
  • %TEMP%\aek57.tmp
  • %TEMP%\aek53.tmp
  • %TEMP%\aek52.tmp
  • %TEMP%\aek54.tmp
  • %TEMP%\aek56.tmp
  • %TEMP%\aek55.tmp
  • %TEMP%\aek36.tmp
  • %TEMP%\aek35.tmp
  • %TEMP%\aek37.tmp
  • %TEMP%\aek39.tmp
  • %TEMP%\aek38.tmp
  • %TEMP%\aek34.tmp
  • %TEMP%\aek30.tmp
  • %TEMP%\aek2F.tmp
  • %TEMP%\aek31.tmp
  • %TEMP%\aek33.tmp
  • %TEMP%\aek32.tmp
  • %TEMP%\aek3A.tmp
  • %TEMP%\aek42.tmp
  • %TEMP%\aek41.tmp
  • %TEMP%\aek43.tmp
  • %TEMP%\aek45.tmp
  • %TEMP%\aek44.tmp
  • %TEMP%\aek40.tmp
  • %TEMP%\aek3C.tmp
  • %TEMP%\aek3B.tmp
  • %TEMP%\aek3D.tmp
  • %TEMP%\aek3F.tmp
  • %TEMP%\aek3E.tmp
  • %TEMP%\aek133.tmp
  • %TEMP%\aek132.tmp
  • %TEMP%\aek134.tmp
  • %TEMP%\aek136.tmp
  • %TEMP%\aek135.tmp
  • %TEMP%\aek131.tmp
  • %TEMP%\aek12D.tmp
  • %TEMP%\aek12C.tmp
  • %TEMP%\aek12E.tmp
  • %TEMP%\aek130.tmp
  • %TEMP%\aek12F.tmp
  • %TEMP%\aek137.tmp
  • %TEMP%\aek13F.tmp
  • %TEMP%\aek13E.tmp
  • %TEMP%\aek140.tmp
  • %TEMP%\aek142.tmp
  • %TEMP%\aek141.tmp
  • %TEMP%\aek13D.tmp
  • %TEMP%\aek139.tmp
  • %TEMP%\aek138.tmp
  • %TEMP%\aek13A.tmp
  • %TEMP%\aek13C.tmp
  • %TEMP%\aek13B.tmp
  • %TEMP%\aek11C.tmp
  • %TEMP%\aek11B.tmp
  • %TEMP%\aek11D.tmp
  • %TEMP%\aek11F.tmp
  • %TEMP%\aek11E.tmp
  • %TEMP%\aek11A.tmp
  • %TEMP%\aek116.tmp
  • %TEMP%\aek115.tmp
  • %TEMP%\aek117.tmp
  • %TEMP%\aek119.tmp
  • %TEMP%\aek118.tmp
  • %TEMP%\aek120.tmp
  • %TEMP%\aek128.tmp
  • %TEMP%\aek127.tmp
  • %TEMP%\aek129.tmp
  • %TEMP%\aek12B.tmp
  • %TEMP%\aek12A.tmp
  • %TEMP%\aek126.tmp
  • %TEMP%\aek122.tmp
  • %TEMP%\aek121.tmp
  • %TEMP%\aek123.tmp
  • %TEMP%\aek125.tmp
  • %TEMP%\aek124.tmp
  • %TEMP%\aek161.tmp
  • %TEMP%\aek160.tmp
  • %TEMP%\aek162.tmp
  • %TEMP%\aek164.tmp
  • %TEMP%\aek163.tmp
  • %TEMP%\aek15F.tmp
  • %TEMP%\aek15B.tmp
  • %TEMP%\aek15A.tmp
  • %TEMP%\aek15C.tmp
  • %TEMP%\aek15E.tmp
  • %TEMP%\aek15D.tmp
  • %TEMP%\aek165.tmp
  • %TEMP%\aek16D.tmp
  • %TEMP%\aek16C.tmp
  • %TEMP%\aek16E.tmp
  • %TEMP%\aek170.tmp
  • %TEMP%\aek16F.tmp
  • %TEMP%\aek16B.tmp
  • %TEMP%\aek167.tmp
  • %TEMP%\aek166.tmp
  • %TEMP%\aek168.tmp
  • %TEMP%\aek16A.tmp
  • %TEMP%\aek169.tmp
  • %TEMP%\aek14A.tmp
  • %TEMP%\aek149.tmp
  • %TEMP%\aek14B.tmp
  • %TEMP%\aek14D.tmp
  • %TEMP%\aek14C.tmp
  • %TEMP%\aek148.tmp
  • %TEMP%\aek144.tmp
  • %TEMP%\aek143.tmp
  • %TEMP%\aek145.tmp
  • %TEMP%\aek147.tmp
  • %TEMP%\aek146.tmp
  • %TEMP%\aek14E.tmp
  • %TEMP%\aek156.tmp
  • %TEMP%\aek155.tmp
  • %TEMP%\aek157.tmp
  • %TEMP%\aek159.tmp
  • %TEMP%\aek158.tmp
  • %TEMP%\aek154.tmp
  • %TEMP%\aek150.tmp
  • %TEMP%\aek14F.tmp
  • %TEMP%\aek151.tmp
  • %TEMP%\aek153.tmp
  • %TEMP%\aek152.tmp
  • %TEMP%\aekD7.tmp
  • %TEMP%\aekD6.tmp
  • %TEMP%\aekD8.tmp
  • %TEMP%\aekDA.tmp
  • %TEMP%\aekD9.tmp
  • %TEMP%\aekD5.tmp
  • %TEMP%\aekD1.tmp
  • %TEMP%\aekD0.tmp
  • %TEMP%\aekD2.tmp
  • %TEMP%\aekD4.tmp
  • %TEMP%\aekD3.tmp
  • %TEMP%\aekDB.tmp
  • %TEMP%\aekE3.tmp
  • %TEMP%\aekE2.tmp
  • %TEMP%\aekE4.tmp
  • %TEMP%\aekE6.tmp
  • %TEMP%\aekE5.tmp
  • %TEMP%\aekE1.tmp
  • %TEMP%\aekDD.tmp
  • %TEMP%\aekDC.tmp
  • %TEMP%\aekDE.tmp
  • %TEMP%\aekE0.tmp
  • %TEMP%\aekDF.tmp
  • %TEMP%\aekC0.tmp
  • %TEMP%\aekBF.tmp
  • %TEMP%\aekC1.tmp
  • %TEMP%\aekC3.tmp
  • %TEMP%\aekC2.tmp
  • %TEMP%\aekBE.tmp
  • %TEMP%\aekBA.tmp
  • %TEMP%\aekB9.tmp
  • %TEMP%\aekBB.tmp
  • %TEMP%\aekBD.tmp
  • %TEMP%\aekBC.tmp
  • %TEMP%\aekC4.tmp
  • %TEMP%\aekCC.tmp
  • %TEMP%\aekCB.tmp
  • %TEMP%\aekCD.tmp
  • %TEMP%\aekCF.tmp
  • %TEMP%\aekCE.tmp
  • %TEMP%\aekCA.tmp
  • %TEMP%\aekC6.tmp
  • %TEMP%\aekC5.tmp
  • %TEMP%\aekC7.tmp
  • %TEMP%\aekC9.tmp
  • %TEMP%\aekC8.tmp
  • %TEMP%\aek105.tmp
  • %TEMP%\aek104.tmp
  • %TEMP%\aek106.tmp
  • %TEMP%\aek108.tmp
  • %TEMP%\aek107.tmp
  • %TEMP%\aek103.tmp
  • %TEMP%\aekFF.tmp
  • %TEMP%\aekFE.tmp
  • %TEMP%\aek100.tmp
  • %TEMP%\aek102.tmp
  • %TEMP%\aek101.tmp
  • %TEMP%\aek109.tmp
  • %TEMP%\aek111.tmp
  • %TEMP%\aek110.tmp
  • %TEMP%\aek112.tmp
  • %TEMP%\aek114.tmp
  • %TEMP%\aek113.tmp
  • %TEMP%\aek10F.tmp
  • %TEMP%\aek10B.tmp
  • %TEMP%\aek10A.tmp
  • %TEMP%\aek10C.tmp
  • %TEMP%\aek10E.tmp
  • %TEMP%\aek10D.tmp
  • %TEMP%\aekEE.tmp
  • %TEMP%\aekED.tmp
  • %TEMP%\aekEF.tmp
  • %TEMP%\aekF1.tmp
  • %TEMP%\aekF0.tmp
  • %TEMP%\aekEC.tmp
  • %TEMP%\aekE8.tmp
  • %TEMP%\aekE7.tmp
  • %TEMP%\aekE9.tmp
  • %TEMP%\aekEB.tmp
  • %TEMP%\aekEA.tmp
  • %TEMP%\aekF2.tmp
  • %TEMP%\aekFA.tmp
  • %TEMP%\aekF9.tmp
  • %TEMP%\aekFB.tmp
  • %TEMP%\aekFD.tmp
  • %TEMP%\aekFC.tmp
  • %TEMP%\aekF8.tmp
  • %TEMP%\aekF4.tmp
  • %TEMP%\aekF3.tmp
  • %TEMP%\aekF5.tmp
  • %TEMP%\aekF7.tmp
  • %TEMP%\aekF6.tmp
Network activity:
Connects to:
  • 'ge####reeh0st.com':80
TCP:
HTTP GET requests:
  • ge####reeh0st.com/setup2.exe
UDP:
  • DNS ASK ge####reeh0st.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android